0
1.0.5
Zurich Patch 9
Standalone Application
MI Core is an AI-assisted Major Incident analysis application for ServiceNow. It helps incident commanders quickly understand the scope, probable cause, business impact, and next steps for complex incidents. The application analyzes incident details, work notes, configuration items, changes, events, historical incidents, and resolver information, then produces a structured investigation summary with evidence, confidence levels, recommended actions, knowledge gaps, and retrospective follow-ups. MI Core supports on-demand analysis from an incident form and configurable automated triggers. Its modular architecture adapts to the capabilities available on each ServiceNow instance and continues to provide useful results when some data sources are unavailable.
- AI-assisted Major Incident analysis
Converts complex incident information into a concise, actionable investigation summary. - On-demand analysis
Allows authorized users to launch analysis directly from the incident form using Run MI Analysis. - Configurable automated triggers
Automatically analyzes incidents based on administrator-defined conditions, such as priority, major incident status, or custom filters. - Multi-source investigation
Correlates incident details with configuration items, recent changes, events, historical incidents, and resolver teams. - Probable-cause analysis
Generates an initial hypothesis, evaluates alternative causes, and explains the reasoning behind the leading hypothesis. - Evidence-based outcomes
Separates known evidence, assumptions, confidence levels, and unresolved investigation gaps. - Business-impact assessment
Summarizes affected services, users, locations, applications, and potential downstream impact. - Recommended next steps
Produces prioritized actions for incident commanders, service owners, engineering teams, and support groups. - Resolver and escalation guidance
Identifies relevant teams and recommends who should be engaged based on available CI, change, incident, and ownership data. - Graceful degradation
Continues to produce useful analysis when optional data sources such as CMDB, Event Management, Change Management, historical records, or on-call data are unavailable. - Modular and extensible architecture
Enables administrators to enable, disable, reorder, or extend investigation modules using script, skill, flow, or agent providers. - Incident write-back
Stores the investigation results and can write the synthesized analysis back to the source incident as a work note. - Retrospective support
Identifies known unknowns, human follow-up tasks, documentation gaps, and process improvements. - Controlled and auditable execution
Runs analysis asynchronously and records investigation progress, outcomes, and execution details. - Human-in-the-loop design
Provides decision support without autonomously approving remediation or replacing incident commander judgment.
New
- Automated Major Incident analysis is now available for responders and administrators. Responders can initiate a consolidated analysis directly from an incident, either manually or automatically based on configurable policies. The system investigates the incident using eligible modules, synthesizes findings such as probable cause, impact, and recommended actions, and stores results in a durable record. Administrators can control module activation, trigger conditions, and custom provider registration without changing core application code.
MI Core requires the following platform capabilities on the target ServiceNow instance:
Required
- ServiceNow platform with support for scoped applications and server-side scripting.
- Now Assist Administration plugin: com.sn_nowassist_admin.
- Generative AI Platform plugin: com.sn_genai_platform.
- Application access for administrators to install, configure, and activate the application.
- Incident Management with access to the incident table.
- Required application roles assigned to users:
- sn_mi_core.admin — configure modules, triggers, settings, and providers.
- sn_mi_core.user — run and view MI Analysis results.
- A configured generative AI provider or connection for AI reasoning features.
- Appropriate cross-scope privileges for any optional data sources that are enabled, such as:
- CMDB
- Change Management
- Event Management
- Knowledge Management
- On-call or assignment data
Optional
The following capabilities improve the depth of the analysis but are not mandatory for the application to run:
- CMDB and configuration item relationships
- Change request records
- Event Management alerts
- Knowledge articles
- Historical incident records
- Resolver group and on-call information
- Now Assist / Generative AI model availability
MI Core is designed to degrade gracefully. If optional data sources or AI capabilities are unavailable, the application skips those modules and still produces an investigation using the information available in the incident record.
Recommended Configuration
- Configure the approved generative AI connection before enabling AI reasoning modules.
- Run the post-installation setup to seed the module registry, default run policy, and bundled skill configuration.
- Assign users the minimum required application role.
- Enable automated triggers only after validating the desired incident conditions.
- Review cross-scope access and data visibility requirements before enabling optional modules.